I was actually thinking about this scenario yesterday. I think doing it on Site B alone should be enough... otherwise bad actors could just point bad links at intermediate domains which are then redirected to your site. Google would have probably thought about that.

Since you own both domains, just disavow on both of them for good measure.